Bug#1094352: bookworm-pu: package simgear/1:2020.3.16+dfsg-1+deb12u1

[Dr. Tobias Quathamer]

Package: release.debian.org
Severity: normal
Tags: bookworm
X-Debbugs-Cc: ***@packages.debian.org, ***@debian.org
Control: affects -1 + src:simgear
User: ***@packages.debian.org
Usertags: pu

Dear release team,

I've received a notification from the flightgear upstream maintainers
that they've discovered and fixed a security issue. I've applied the
proposed fix and already uploaded the package to unstable.

The security team suggested that a stable update might be good, as the
bug doesn't seem to need a DSA.

Please note that there's currently no CVE assigned (still in progress),
and there's also not a Debian bug in the BTS. However, the issue is
tracked in our security tracker:

https://security-tracker.debian.org/tracker/TEMP-0000000-5E50D9

Please find the patch attached which I'd like to upload for the next
stable point release.

If you accept this upload, the package "flightgear" needs an upload as
well. I'll file a bug about that shortly after this one.

Regards,
Tobias

[Debian Bug Tracking System]

Post by Dr. Tobias Quathamer
affects -1 + src:simgear

Bug #1094352 [release.debian.org] bookworm-pu: package simgear/1:2020.3.16+dfsg-1+deb12u1
Added indication that 1094352 affects src:simgear

[Debian Bug Tracking System]

tag -1 confirmed

Bug #1094352 [release.debian.org] bookworm-pu: package simgear/1:2020.3.16+dfsg-1+deb12u1
Added tag(s) confirmed.

[Jonathan Wiltshire]

Control: tag -1 confirmed

Please go ahead, ideally with a CVE identifier in the changelog (unless
that's going to take more than a few weeks to obtain). A Debian bug is also
nice for version tracking, but neither are crucial.

Thanks,

[Jonathan Wiltshire]

package release.debian.org
tags 1094352 = bookworm pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bookworm.

Thanks for your contribution!

Upload details
==============

Package: simgear
Version: 2020.3.16+dfsg-1+deb12u1

Explanation: fix sandbox bypass vulnerability in Nasal scripts [CVE-2025-0781]

[Debian Bug Tracking System]

Post by Jonathan Wiltshire
package release.debian.org

Limiting to bugs with field 'package' containing at least one of 'release.debian.org'
Limit currently set to 'package':'release.debian.org'

Post by Jonathan Wiltshire
tags 1094352 = bookworm pending

Bug #1094352 [release.debian.org] bookworm-pu: package simgear/1:2020.3.16+dfsg-1+deb12u1
Added tag(s) pending; removed tag(s) confirmed.

Post by Jonathan Wiltshire
thanks

Stopping processing here.

Please contact me if you need assistance.